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INTRODUCTION 


All societies and individuals have recognized exposure to personal risk as a normal 
aspect of our life. Presumably such risk exposures have been accepted as necessary 
to attain a compensating benefit. This relationship has been explored previously, 
and several hypotheses have been suggested to explain the historically accepted 
balances of risk and benefit (1, 2). 

When individuals have “voluntarily” taken risks for personal pleasure or profit, 
they appear to be willing to accept relatively high risk levels in return for rather 
modest quantifiable benefits. For example, sportsmen frequently explore the outer 
physical limits of their chosen activity—with many resultant statistical accident 
records of their risk-taking propensities. Assuming that intangible benefits do exist, 
the controlling parameter appears to be the individual’s perception of his own 
ability to manage the risk-creating situation. If he believes he can do so, he is 
likely to take the chance. 

The situation changes markedly when the individual no longer believes he can 
control his risk exposure. In such “involuntary” situations, the risk management 
is in the hands of a societal group usually remote operationally from the individual 
and his risk exposure. Major societal technical systems all create such involuntary 
risk exposures—for example, transportation systems, energy supply systems, public 
utilities, and food supply systems. Whereas in the voluntary case the feedback loop 
of “control of risk—benefit balance” is very tightly coupled by the individual, in the 
involuntary case this loop is usually very weakly coupled, dimly perceived, and 
with each of its elements usually dispersed in time, geographically, politically, 
and managerially. Under these circumstances, the individual exposed to an in- 
voluntary risk is fearful of the consequences, makes risk aversion his goal, and 
therefore demands a level for such involuntary risk exposure as much as one 
thousand times less than would be acceptable on a voluntary basis (1, 2). 

Inherent in all operational major technical systems is an implicit choice of such 
an acceptable level of risk for the involuntary exposure of the public. The study 
reported in (1, 2) has suggested the hypothesized relation shown in Figure | between 
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risk and benefit as a typical basis for such decisions. The figure shows the approximate 
relation between the per capita benefits to real income of a system and the 
acceptable risk as expressed in deaths per unit time (i.e. time of exposure in units 
of a year). The highest level of acceptable risks that may be regarded as a reference 
level is determined by the normal US death rate from disease (about | death/year 
per 100 people). The lowest level for reference is set by the risk of death from 
natural events—lightning, flood, earthquakes, insect and snake bitcs, ctc (about 
1 death/year per 1,000,000 people). 

Between these two bounds, the public is apparently willing to accept involuntary 
exposures—i.e. risks imposed by societal systems and not easily modified by the 
individual—in relation to the benefits derived from the operations of such societal 
systems. 

In common familiar terms, an involuntary risk may be considered excessive if it 
exceeds the incidence rate of disease, high if it approaches the rate, moderate if the 
risk is about 10-100 times less, low if it approaches the level of natural hazards, and 
negligible if it is below this. Events in these last two levels of risk have historically 
been treated as acts of God by the public generally —in recognition of their relatively 
minor impact on our societal welfare compared with the effort required to avoid 
the risk. 

Thus any risk created by a new sociotechnical system is acceptably “safe enough” 
if the resultant risk level is below the curve of the figure. If, as is usually the case, 
a new technical system has a range of uncertainty in its risks, a design target may 
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Figure | Benefit-risk pattern of involuntary exposure. 
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be set below the curve by an equivalent amount—possibly as much as a factor of 
10 or 100. 

Although the relationship hypothesized in Figure | appears reasonable, :ts 
quantitative aspects should be considered as very tentative and primarily useful 
for illustrative purposes. The evaluation of the comparative benefits derived from 
the availability of technical systems is complex, difficult, and presently more heuristic 
than analytic. Because most new technical systems initially appear to be replace- 
ments for existing systems (for example, nuclear for coal power), public policy is 
generally concerned with comparative risk levels rather than comparative benefits. 
Perhaps it is not usually foreseen that new technology is likely to affect societal 
systems profoundly—the automobile became more than a substitute for the horse, 
although it was originally perceived only as a horseless carriage. 

Thus, because comparative risk analysis is the issue of primary national concern, 
this chapter focuses its discussion on the risk portion of the risk-benefit balance. 


EVALUATION OF RISK 


The study of risk analysis has as its objective the development of a methodology 
for predictive evaluation of future risks. Unfortunately, the literature on “futures” 
is apt to be obfuscated by a mix of personal value-system assessments of present 
trends and imaginative scenarios of alternative futures, usually written to dramatize 
the author’s bias. For this reason it is useful to recognize the existence of four 
different evaluations of future risk, as follows: 


1. real risk, as will be determined eventually by future circumstances when they 
develop fully ; 

2. statistical risk, as determined by currently available data, typically as measured 
actuarially for insurance premium purposes ; 

3. predicted risk, as predicted analytically from system models structured from 
historical studies ; and 

4. perceived risk, as seen intuitively by individuals. 


Air transportation illustrates the above types of risks. To the flight insurance 
company, flying constitutes a statistically known risk; to the passenger purchasing 
the insurance at the airport, a perceived risk. In this case the perceived risk usually 
exceeds the statistical risk.! To the Federal Aviation Administration, anticipated 
changes in air traffic patterns and equipment involves predicted risk as an approxi- 
mation to future real risk. : 


Perception 


In some cases, the risk that an assessor predicts by careful analysis of experimental 
and historical data, the use of scientific laws, transfer of experience from related 


' The rate for life insurance at airports is $0.25 per $7500 insurance per flight. By 
1971 data, this rateis approximately 30 times the actuarially fair value. Regular life insurance 
is usually available at somewhat less than twice the actuarially fair rate. 
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data, or a combination of these methods does not correlate well with either an 
individual or a societal perception of risk. Perhaps the single most important factor 
in risk perception is risk manageability or controllability, where an individual feels 
safer if given some control over the degree of risk from an activity. Examples of 
this may be found in transportation where individuals perceive more risk from 
flying than driving, or in skiing, when an individual expresses more fear riding a 
chair lift up a mountain than skiing down. In both cases, the perception is not 
borne out by accident statistics. This is possibly the significant issue that results in 
voluntary activities having acceptable levels of risk several orders of magnitude 
higher than the levels associated with involuntary activities (1). It is usually difficult 
to differentiate between a faulty perception of risk and its distortion by a personal 
value system that results in a preference for a statistically higher risk, even when 
the risks are known, as in sports. 

An important factor in the perception of risk is the probable severity of injury 
ifan accident were to occur. A complete assessment of risk requires that the potential 
effects of an accident be combined with a probability of occurrence. Because the 
accident probabilities are usually not given significant weight in an individual 
perception, concentration on accident consequences can lead to distortions of per- 
ception. Again the perceived safety of commercial air transportation suffers relative 
to the automobile (although the real risk is less) because the results of an average 
aviation accident are far more severe than the effects of the average automobile 
accident. Similarly, motorcycling is perceived as far more dangerous than automobile 
travel becausc of this perceptual factor. In this case, the perception is accurate, as 
accide it statistics reveal that motorcycle riders are exposed to a greater risk than 
automobile passengers. 

Another very significant factor is the episodic nature of some risks. On an 
individual level, a risk is usually perceived as a probability of death, with less 
severe effects such as disability, either temporary or permanent, considered in- 
significant in comparison to the risk of fatalities. On a societal level, the episodic 
preoccupation is evident in the common concern with disasters claiming many lives, 
while in fact single-fatality accidents are responsible for the majority of all accidental 
deaths. It thus seems that the size of the potential accident is given more weight 
than the probability. This factor dominates the popular perception of risk from 
nuclear power plants, and can be recognized when the criticisms of nuclear power 
are examined, as the potential results of a major accident are frequently cited with 
no mention of the associated probabilities. This is probably representative of societal 
values to a great degree, and activities capable of producing catastrophic accidents 
therefore must meet more stringent societal standa-ds than higher-frequency, 
individual risks. The failure to consider probability is, however, a perceptual factor. 

One time-dependent effect that occurs in risk perception is the discounting of 
future risk. The risks of smoking would seem far less acceptable if the risk were 
experienced immediately, rather than developed over a number of years. This 
perception does not seem to apply when nuclear power is discussed, probably 
because of the dramatic scenarios that have been developed for hypothetical nuclear 
accidents. Because the principal health effect of low-level radiation exposure is 
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increased likelihood of cancer in the future, occurring perhaps 15 to 45 years after 
exposure, this risk should also be discounted. In most adversarial discussions of 
nuclear power, these are treated as immediate fatalities. 


Perception of Benefit 


Just as risk may be perceived to be different from the assessed value, so too may 
societal perceptions of benefit vary. In a previous paper (1), an attempt was madc to 
relate risk data to a crude measure of public awareness of the associated social 
benefits (see Figure 2). The “benefit awareness” was arbitrarily defined as the 
product of the relative level of advertising, the square of the percentage of population 
involved in the activity, and the relative usefulness (or importance) of the activity 
to the individual. These assumptions may be too crude, but Figure 2 does support 
the reasonable position that advertising the benefits of an activity increases the 
public acceptance of a greater level of risk. Smoking has been cited as an example 
of a perceived benefit due in large part to advertising (3). The decision to ban 
cigarette advertising on television indicates a tacit understanding of this phenomena. 


Perception versus Reality 


When a gap appears between the perceived and assessed risks and benefits, the 
societal decision-makers are called upon to resolve the conflict. A recent example 
of such a resolution was the requirement that automobiles be equipped with a 
seat belt interlock system. In this case, the individual perception underestimated 
the risk, as the majority of people were not using seat belts. The regulatory 
decision was made that the reduction in risk was substantial enough to justify the 
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BENEFIT AWARENESS 


Figure 2 Accepted risk versus benefit awareness. 


Annu. Rev. Energy. 1976.1:629-662. Downloaded from www.annualreviews.org 
Access provided by 2601:8c0:8180:2d10:5a3:72ed:ad60:293 on 10/20/23. For personal use only. 


634 STARR, RUDMAN & WHIPPLE 


cost of the safety system. This regulation was subsequently repealed because the 
total social cost of the system was underestimated, that is, the cost of inconvenience 
was apparently significantly large. 
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Figure 3 Illustrative flow chart: risk analysis. Source: (4). 
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No general method of dealing with differences between perception and technical 
assessment exists in the societal decision-making process. This problem is not 
directly within the realm of the technologist, as the technologist is not generally 
the decision-maker. The role of the technologist is to provide an assessment of 
risk and benefits. The societal perceptions and values are made visible through 
normal political inputs. The technologist should, however, indicate to the decision- 
maker that reliance on societal perceptions will usually result in a misallocation 
of resources. The difficult task of separating faulty perceptions from societal 
values has not been resolved. 

Situations frequently arise where the individual member of society simply does 
not have the information to relate perception to reality. As a case in point, we 
may consider the perception of the solar system. To those who are not astronomers, 
the visible evidence is that the sun travels around the earth. The only reason 
that the population as a whole believes otherwise is that the word of the scientists 
has become part of the common wisdom. What seems significant about this 
situation is the duration of the perceptual lag, that is, the time between scientific 
discovery and cultural acceptance. 

Three levels of perceptual problems can be identified. First, there are the real- 
time problems of perception. These include the factors previously identified as 
controllability, episodic preoccupation, and other similar effects. The second problem 
is perceptual lag. In general, perception eventually catchesup with reality, but the 
time required may result in a massive misallocation of resources in the interim. 
The third level of perceptual problem is assessment of hypothetical future risks. If 
decisions were based entirely upon public perception, many technologies would 
not exist now because an exaggerated fear of new risks would have prohibited their 
introduction. 


Societal Value System for Risk 


The incorporation of risk estimates into national decision-making is in its early 
stages of methodological development. The use of a societal value system for risk 
acceptance must rank as the major unresolved issue in this part of the decision 
process. While methods have been proposed (4), none has yet been put into practice. 
Figure 3, taken from (4), is representative of a proposed method of dealing with 
this issue. 

In the past, and to a lesser extent at present, the scientific community has tended 
to view risk-taking decisions based on factors other than the expected value of the 
risk as irrational. Because society responds to more factors than just expected 
value, a conflict has arisen. An outgrowth of this conflict has been that groups 
concerned or threatened by risk have rejected the estimates developed by the risk 
analysts. In seeking an input to the decision-making process, these groups have 
challenged the estimated risk, because on intuitive grounds the risk seemed less 
acceptable than the expected value would indicate. The need to consider these 
public perceptions is clear. 

Although the source of conflict may be recognized, the resolution of the societal 
decision-making process is by no means simple. The societal value system fluctuates 
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with time, and the technological capability to follow fast-changing societal goals 
does not exist. As an example, the emission requirements for automobiles were 
established at a time when air quality was considered far more important than 
fuel economy or cost. The societal goals in this area have seemingly changed to 
some degree, as these two latter considerations are now given more weight. 

This fluctuation of social values makes the decision process more difficult and 
serves as perhaps the strongest argument for analytic decisions. Resolving the gap 
between societal perception and analytically expected value is of prime importance 
and requires a balanced consideration of both concepts. The aim of such a process 
is to maintain consistency within the framework of a value system. 

The particular method referred to in Figure 3 is called utility theory; briefly 
stated, its estimatcs measure the social values’ associated with various objectives 
on a common scale. In theory, the diverse social costs associated with energy 
production, and with a lack of energy, may be estimated for comparison. The key 
question in such a method is that of estimating a societal utility function. This 
process occurs in a nonempirical manner at present. The social value system is 
made known through various channels of public expression such as elections, 
letters to congressmen, and the many polls. Such a process is incapable of 
separating values from perceptions. 


Use of Risk Data 


A decision-maker is frequently called upon to compare different types of risk 
(and more generally, different types of social cost) resulting from any of the various 
options under consideration. 

At one end of the spectrum is the social cost function that follows expected 
value rather closely. This approach is taken by the US Public Health Service in 
decisions regarding their budget allocations. In this case the goal is to minimize 
disability days because the social cost is assumed directly proportional to the total 
number of days of disability. 

A second type of social cost function results if an individual’s value system is 
used. Perhaps this explains the charitable organizations that raise money for research 
to develop cures for multiple sclerosis or muscular dystrophy. In terms of disability 
days to society, these diseases are probably far Icss significant than the common 
cold. The catastrophic nature of the effects upon the individual results in a 
personal evaluation of a very high social cost. 

One way to represent the difference between the two systems is to assume that 
personal value systems charge an increasing social cost to each successive disability 
day. As an example of this proposed representation of the personal value system, 
the social cost of one individual being disabled for a year is greater than the cost 
of 365 separateindividuals each sick for one day. An example of such a representation 
would be 


total social cost = NC,(1 +i)‘, 1. 


where N is the number of individuals involved, i is a daily interest rate, t is the 
time in consecutive days of disability, and C, is the personal cost of one disability 
day. If such a representation is used, the curve in Figure 4 is obtained. 
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The mix of personal and societal cost scales selected is dependent upon the 
decision-making agency. Autocratic countries and military organizations are more 
likely to use a societal scale because for these agencies the general welfare of society 
is placed above that of an individual. Democratic governments are more likely to 
use a mix of both scales ; the congressional decision to spend extensively for cancer 
research is probably a result of a personal value system. 

The choice of a cost system will, in some cases, determine whether an option with 
a high probability of a few fatalities is preferable to an option with a lower 
probability of a greater number of fatalities. While there are compelling arguments 
for both systems, the choice can only be made by a reading of the public’s 
preference. 

The term value of life appears fiequently in the risk -benefit literature, and the 
meaning is derived in a variety of ways (5). The original approach was to discount 
future earnings at an appropriate rate, to arrive at some value. Such a method has 
obvious drawbacks, for the life value of retired persons goes quickly to zero as 
does the value for those who work without direct compensation (e.g. housewives). 
Court awards for accidental deaths are not representative, for the compensation 
to an individual's survivors is probably representative of lost earnings. The 
approach taken by Sagan (6) is to charge a flat rate ($50) per day of disability 
and to use the National Safety Caquncil equivalent of 6000 disability days for a 
death, which gives a life value of $300,000. This is a valid method if the societal 
value system is used, but it would not work for the personal system. A method 
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Figure 4 Value systems for social costs of disability. 
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frequently employed is called self-evaluation. In this case, the premiums paid to 
workers in hazardous occupations are compared with the increased risk, and the 
marginal risk-benefit trade-off for an individual is scaled upward to a life value. 
Implicit in such a calculation is the assumption that the individual knows the level 
of risk and that employment in a similar but safer occupation is available at a 
slightly lower wage. In addition, the increase in risk must be small, or nonlinear 
effects (risk aversion) will occur. In general, the value of life remains a loosely 
defined.term ; the social values for risk should be more clearly defined before such a 
definition is made. 


Comparison of Risk and Benefit 


It is rare to find a technology that provides a new benefit. The high-technology 
energy and transportation systems frequently used as examples in risk-benefit 
studies are always competitive with other energy and transportation technologies. 
When a new technology arises—for example, a medical treatment for a previously 
incurable condition—the risk-benefit analysis weighs the social cost against the 
benefits to gain insight into the criteria for acceptability. 

A more common procedure is to compare several technologies through a risk- 
benefit viewpoint. In an analysis of the risks associated with nuclear power, it is 
more common to weigh these risks with the social costs of using coal or oil than to 
balance risks and benefits. The reason for this is simple. Coal and oil have been 
acceptable fuels for power plants for years. If the social costs of nuclear power 
compare favorably with those of coal and oil, then nuclear power automatically 
satisfies the risk-benefit criteria. Under these circumstances, the concept of benefit 
remains simple: the benefit is expressed in terms of electrical energy. Such a 
situation proves enormously helpful in an assessment of an energy technology 
because no widely accepted method of assessing benefits exists. 

The typical problems of assessing benefits of energy, and electrical energy in 
particular, stem from the fact that prices are set according to costs, and a free 
market condition does not apply (7). Attempts to improve the benefit-assessment 
methodology frequently include additional benefits such as tax revenues and local 
employment, but these techniques usually represent double accounting. An alterna- 
tive method from classical welfare economics is to use the concept of the consumer 
surplus, but such a method produces severe measurement difficulties. Fortunately, 
an assessment .of benefits is not necessary for the general analysis of energy 
technologies. The historical record of energy usage provides proof of the acceptability 
of the technologies associated with the use of fossil fuels to generate power, 
with the possible exception of strip mining. If the total social costs of new energy 
technologies are lower than the social costs associated with the traditional 
production methods, then societal acceptability has been demonstrated. 

A method commonly employed in comparison of energy technologies is predicting 
the health costs from various types of power plants with the assumption that 
each plant is of a given power rating and the plants are sited at equivalent 
locations. In this case the benefits are truly identical: the generation of power to 
serve the needs of a given population. The quantification of social costs may be 
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simplified under these circumstances, since all social costs need not be translated 
into a dollar amount. Instead, each technology is responsible for various types of 
health effects, which may be expressed in more convenient units such as injuries, 
fatalities, disability days, or years of life shortening. Due to the societal distinction 
between voluntary and involuntary ‘risk, the analyses are frequently divided into 
occupational and public health effects. A risk-benefit analysis includes all the social 
costs associated with a given technology. In the electrical power field, this generally 
includes all health costs associated with the mining, transport, and preparation of 
fuel, combustion of fuel, and waste disposal. The combustion of fuel includes 
effects from both normal operations and potential accidents. In addition, an 
analysis of nuclear power requires the consideration of fuel reprocessing. The one 
health cost generally not considered in the analysis is the effect of the use of 
electricity, namely electrocution and electrically caused fires, because this is indepen- 
dent of the method of generation. Additional social costs include burdens on the 
environment and most frequently are expressed in terms of land-use requirements 
and quantities of pollutants emitted. 

The methodology of assessing social costs due to environmental burdens is 
less developed than the comparative health cost methods. The reason for this is that 
the environmental burdens are of an aesthetic nature, whereas health costs may 
usually be translated into medical costs, days of disability, and fatalities. For this 
reason, risk-benefit studies have focused upon the health effects associated with the 
production of power, with less detailed comments offered regarding the environ- 
mental burden. 

An even more difficult externality to quantify in the energy field is the potential 
social cost of undependable supplies of a particular form of energy. The current 
emphasis applied to reducing oil imports and establishing a goal of energy self- 
sufficiency indicates that this externality is now recognized. On a smaller scale, 
some industries are now switching from natural gas to electricity, due to the threat 
of nonavailability. An example of this is the glass industry, which is now building 
electric furnaces for glass manufacturing. Reliability of fuel supply is a significant 
factor in electric utility planning, although cost is also a major factor. 


Interpreters of Risk-Benefit Analysis 


The roles of the various participants in a risk-benefit decision process depend 
largely upon the societal structure. It seems that the scientist’s role includes those 
activities up to and including the quantification of impacts, regardless of the 
decision-making process (see Figure 3). 

In an autocratic society, the social costs of accidents are assumed directly 
proportional to the estimated expected values of direct accident costs. In this case, 
a social value system relating to risk characteristics (shown as worth of alternatives 
on Figure 3) is not applied, and the decision process is rather automatic. The 
risk assessor may in fact be the decision-maker. 

In more egalitarian societies, the scientist’s role ends with the quantification of 
impacts. The worth of alternatives has generally been added to the decision process 
by special-interest groups, letters to decision-makers, editorials by opinion-makers, 
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and other inputs of political measure to the decision-maker. The degree to which 
the decision-maker (in this case, an elected official) accurately interprets and 
responds to the political input determines, to some degree, the success of the 
decision-maker. Two ways exist in which such a process can result in decisions 
inconsistent with societal values and scientific assessments. First, the input to the 
decision-maker may not accurately reflect the overall social values of the public. 
Second, the input is usually expressed as a recommendation, either pro or con, 
for a particular alternative of the decision process. In this case the input may 
reflect a faulty perception of the situation, rather than an accurate expression of 
values. 

The issues are clouded because some degree of scientific disagreement exists about 
virtually every controversial topic. To provide a measure of consistency, the risk- 
assessor or members of the public can do several things. First, the assessor can 
indicate that certain courses of action are more consistent with prior societal behavior 
and, second, the character of the risk may be explored to indicate which risks are 
likely to be misperceived. Through the use of this information, the decision-maker 
can more accurately interpret the social values implicit in the political input. The 
goal of such a method 1s a separation of the debates over societal goals and 
scientific estimates. 


" Use of Risk-Benefit Analysis 


Risk-benefit analysis can be applied in three principal areas. The first area relates 
to the allocation of resources for safety expenditures. In general, a law of diminishing 
returns applies to all types of controllable risk : risk reduction becomes progressively 
more expensive. If an accepted methodology for determining the social cost of risk 
is developed, safety allocations would be determined as demonstrated in Figure 5. 

Ideally, safety expenditures should be made until the marginal exchange between 
social cost and control cost is equal; that is, the expenditure of one dollar for safety 
is expected to reduce the social cost by one dollar. This results in the most 
efficient allocation of resources available to reduce all risks. 

The second area of application for risk-benefit analysis is in the setting of 
standards, whether for occupational safety or for public health risks. This will 
provide an analytic basis for trade-offs such as that between automotive emissions 
and mileage, and electric power plant emissions and electricity cost. 

The final and most important application is in societal risk-taking decisions. 
Risk-benefit analysis provides a background of consistency through which decisions 
can be carefully examined. The consistency produced will ensure that the path of 
minimum social cost will be selected. 


NATURE OF RISK 


Before a methodology for dealing with risk on a societal level can be developed, 
it is first necessary to examine the nature of risk and the history of societal risk- 
taking. Each major element in such a process is described below. 

Risk is defined here as the probability per unit time of the occurrence of a unit 
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cost burden. The cost burden may be measured in terms of injuries (fatalities or 
days of disability) or other damage penalties (expenses incurred) or total social 
costs (including environmental intangibles). Risk thus involves the integrated 
combination of (a) the probability of occurrences, (b) the spectrum of event 
magnitudes, and (c) the spectrum of resultant personal injuries and related costs. 

As thus defined, risk is directly related to the familiar insurance premium 
determination for any class of activity. Thus, automobile insurance premiums are 
based on the frequency of collisions, the distribution of their physical magnitude, 
and the distribution of the resultant damage. Better roads are addressed to the 
first point, elastic bumpers to the second, and seat belts to the third. This 
separation of parameters is often glossed over in many discussions of the subject, 
but it is important for analytic studies. 


Characterization of Risk— Exposure Probabilities 


The probability of exposure to risk (the first item above) has three major elements : 
space, population, and time dependency. 

The spatial character of exposure probabilities can range from quite localized 
risks to global hazards. For example, the production and utilization of energy 


TOTAL COST 


Cost ofr s< cartrol 


COST TO SOCIETY 


Equal slopes, 
ealimum leve: of risk 


Social cost from risk 


LEVEL OF RISK 


Figure 5 Social costs and control costs versus level of risk. 
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causes effects over a wide range of space; hydroelectric dams and some pollutant 
emissions represent localized risks, whereas the production of carbon monoxide, 
the increase in global turbidity, and nuclear safeguards are of global concern. 

A second aspect of exposure probability is determined by population dependency. 
For many types of risk, specific groups may be identified as the population fraction 
that bears a specific risk. While many such groups exist, certain group characteristics 
may be identified as the determinants of the risk-bearing population. The following 
list includes some types of group-dependent risks: 


1. heredity—genetic diseases ; 

2. age—childhood or geriatric diseases, certain accident probabilities that are higher 
for certain age groups, such as poisons (children) and falls (older persons) ; 

3. occupation— pneumoconiosis (black lung disease) among coal miners, burns to 
fire fighters, and many other occupational hazards; 

4. sex—incidence of heart attacks in males, risk to women in childbirth; 

5. activity groups—smokers, skiers, and gun owners, 


The time-dependent exposure probability may be classed into three major groups: 


. continuous—describes most diseases and accidents that can occur any time; 

. periodic—certain risks that are periodic in nature such as hurricanes, tornadoes, 
influenza, and some earthquakes ; 

3. cumulative—the exposure probability of risk that is in some cases related to 

previous exposure such as smoking, pneumoconiosis, asbestosis, and radiation 

effects. 


NO 


Magnitude and Impact of Events 


The magnitude of a risk event is a physical measure and does not consider the 
consequences of an event to individuals. In this sense, an event’s magnitude is not 
directly a measure of risk, but rather one of event characteristics. Examples of such 
measures are magnitude of an earthquake, height of a flood, or energy release from 
an explosion. 

Impacts measure the effects of risk events upon exposed populations. As such, the 
impact is one key part of risk (the other is probability). This distinction between 
magnitude and impact is made because estimates of risk (probability of a specified 
impact) are frequently derived from a combination of two estimates: probability of 
an event of a given magnitude and the impact of an event versus magnitude. The 
relationship between magnitude and impact is explored in the next section under 
rare events and risk. 


HYPOTHESIZED LAWS OF RISK 


Risk has certain usually repeatable characteristics, which may be termed laws of 
risk. An exploration of these characteristics is useful for the purpose of comparing 
risks from different sources. : 
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Logarithmic Relationship between Probability and Magnitude 


Risk is properly defined as the probability per unit time of a unit cost burden 
(injury) occurring. It consists of both the probability that some event will occur 
and the magnitude of damage that results if the event occurs. From data for 
various types of risk (see Figures 6 and 7) it is clear that the probability and 
magnitude are not independent but that for many risks the high-impact events are 
much less common than the lower-impact events. This result is in itself not surprising 
where societal choice existed, for it seems clear that in response to both natural 
and man-made hazards, successful societies have selectively evolved in a manner 
designed to avoid catastrophic events. What is surprising is that even for natural 
phenomena (earthquakes) the probability, or frequency, of the event usually falls off 
at least as fast as an exponential function of the magnitude for many types of 
risks (see Figures 8 and 9). Mathematically, this is 


log f = a—bm, 2, 


where f is the frequency, m the magnitude, and a and b are constants. 

If estimates of the probability of high-magnitude events are desired, the data 
base is usually sparse because the events are rare. The probability distribution 
for the general type of risk can, however, be estimated from the available data 
for less extreme cases. A class of statistical distributions, known as asymptotic 
distributions, have proven useful in estimating extreme probabilities for natural 
hazards such as floods and earthquakes. The asymptotic distributions come from 
the theory of extreme value distributions (9) and are useful because less restrictive 
conditions are required for the use of the asymptotic distributions than for the 
exact distributions of the extremes of functions (10). Extreme value distributions 
deal with the distribution of the maximum or minimum values in large samples of 
independent values drawn from an initial distribution. This approach requires 


_ knowledge of the initial distribution and the sample size. 


The asymptotic-type distributions do not require as detailed information; the 
sample need only to be large and the initial distribution must satisfy more general 
requirements. F(x) is the probability that some random variable is less than x 
(the cumulative distribution). If F(x) tends to unity at least as fast as an exponential 
as x — 00, then the maximum values of large samples of independent events follow 
the Type I asymptotic distribution of maximum values. This condition is satisfied 
if the initial distribution is gamma, exponential, chi-square, normal, or lognormal, 
among others. The Type I asymptotic distribution for maximum values is 


F(x) = exp [—e7 ae). ; 
From this it can easily be shown that 
f(x) = aexp[—a(x—b)— e748"), r 


which reduces asymptotically to 


f(x) = ae~e, 5. 
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Figure 7 Total deaths arising from accidents that kill M people versus magnitude. 
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Figure 8 Magnitude distribution of shallow earthquakes 1904-1952. 
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Figure 9 Mississippi River floods, Vicksburg, Mississippi, 1898-1949. Source: (9). 
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similar to equation 2. The return period for rare events is defined as 


1 


T(x) = 1 Fw’ 


and asymptotically it converges to 


T(x) = etx) 


7. 


If, as an example, large earthquakes of magnitude m are considered, the common 


notation is (10) 


F(m) = exp[—2e >"), 


which can be written in Type I asymptotic form as 


ae In x 
Fimp=expy—exp} btm ij 


4% 


so the return period is 


! b 
T(m) = —e’™ (years), 
64 


10. 


which means that it takes an average of T(m) years to observe an earthquake of 


magnitude m. 


This type of distribution is frequently applied to floods (9, 10), and the nature of the 


result may be seen from Figure 9. 


A general list of natural hazard distributions has been compiled (11) (see Table 1) 


Table 1 Examples of natural phenomena described by probability distributions* 


Poisson Distribution 


1. Meteorite strikes on (potential) human 
targets (12) 


Negative Binomial 


1. Frequency of tornadoes (13) 


Gamma Distribution 


1. Sea waves: height (14) 

2. River levels: recurrence of levels being 
exceeded (15) 

3. Precipitation: drought occurrence (16) 

Exponential Distribution 


I. River levels (15) 


4 Source: (10). 


Rayleigh and Weibull Distribution 


1. Wind speed (17) 
2. Wave heights : trough-to-crest (14) 


Lognormal Distribution 


1. Tsunamis (18) 

2. Hydrologic series (various examples) 
(19) 

3. Tornadoes: dimension of damage swath 
(13) 

4. Flood damage magnitude: USA (20) 

5. Earthquakes: magnitude and frequency 
(21) 
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and demonstrates that most natural hazards do satisfy the conditions necessary to 
be of the Type I asymptotic form. 


Rare Events and Risk 


An estimation of risk from rare events entails three steps. First, the probability 
of an event of given physical magnitude must be estimated, as described above. 
Second, the manner in which such an occurrence can produce injuries or fatalities 
must be developed, and finally the population distribution in the vicinity of an 
occurrence must be known. In general, the population distribution is easily measured 
or estimated ; estimates of injuries from an event are more difficult to perform. 

All rare events of this type have one common feature, the release of energy. 
To translate this into an estimate of risk, two mechanisms must be quantified: the 
nature of energy transport through the population and the relation between energy 
exposure and injury. These mechanisms may be either probabilistic or deterministic, 
and it does not seem that either mechanism is capable of being described in a 
general sense for a large class of risks. As examples of energy transport mechanisms, 
several hazards may be considered. Earthquake and explosion energies are best 
described deter ministically ;earthquake propagations can be estimated from measur- 
able soil characteristics, and explosions transmit energy that varies with the inverse 
of the square of the distance, to a first-order approximation. A man-made hazard 
that also produces an energy release that propagates in a deterministic method is a 
flood due to a dam failure. In this case, the flood plain may be predicted. 

Probabilistic transport mechanisms apply for estimates of hazard from events 
such as forest fires and nuclear power plant accidents, because in both cases the 
energy transport is strongly dependent upon the wind direction and speed, where 
the wind can only be characterized in a probabalistic sense. In any case, a general 
rule is that individual energy exposures are proportional to the total energy release. 

The relationship between individual energy exposure and the degree of injury is 
frequently more difficult to quantify but does have some general characteristics. 
For many types of hazards, two thresholds may be defined. The first threshold 
places a lower bound on certain energy exposures; this level cannot produce 
injuries. Mechanistically, this lower bound corresponds to exposures to which the 
body responds elastically. The upper threshold defines a level of individual energy 
exposure that will cause death, if physical injuries are considered, or complete 
destruction in the case of property damage. 

To consider the meaning of these thresholds, an example of an airplane accident 
may be used. In a crash, the individual energy exposures in general are in excess 
of the upper threshold, and thus death is the most likely result. A bump caused 
by slight turbulence or a rough landing rarely exceeds the lower threshold, and no 
injuries result. 

For those exposures in which the two thresholds are quite close in value (such 
as the effects of electric shock or drowning) the body is said to be quite resilient. 
This implies that recovery from a nonlethal level of energy is usually rapid. The 
response to other damage mechanisms, such as mechanical injury, is one of lesser 
resilience. 
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Between these two thresholds, the damage is a monotonic function of energy, 
although frequently in a probabilistic sense. 
An example of a single mechanistic model of the damage due to a localized 
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Figure 10 Dwelling damage versus wind speed relationships. Source: (23) except for 
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energy exposure can be postulated for the property damage due to wind gusts. 
In this case, the damage is assumed to vary as the cube of the velocity, because 
that is the rate at which wind transmits energy to structures. This model is in 
excellent agreement with experimental evidencc (22, 23) (see Figure 10). In the case of 
wind, the upper damage threshold occurs at approximately 250-280 mph. 

While a general response to hazards cannot be found, the empirical evidence 
is that the damage resulting from a range of event magnitudes also varies as the 
log of the frequency (see Figures 6, 7, and 11). From this empirital evidence, it is 
possible to construct a single, three-dimensional surface for the number of accidents, 
A, as a function of d disability days lost per person and n people injured per accident 
(see Figure 12). Because the data are difficult to obtain, Figure 12 is only an approxi- 
mate representation of the actual surface. The surface is defined by 


a 
’ 
nd 


where a, b, and c are constants. 


A(n, d) = 11. 


1 


Temporary tota disability 


iE 
2 

w 

Q 

ra) : 
0 : 
Se i | 
oO _ 

28 1071|-. 

ee) 

ann 

<> 

Ne 

aa Permanent disability 

ra] 7 (NSC equivalent! 

22 

Oa 

r2 

5¢ 1 
ao | 
cz 

ah 

a2 2 boos 

>@ 1 

ka 

re 

ire] 

<x 

a 

io} 

ica | 
i | 


Death (NSC equivalent! @ 


10" 102 102 104 
AVERAGE DAYS LOST PER INJURY {d} 


Figure 11 Probability distribution of disabling and fatal accidents versus average days 
lost (US manufacturing industries, 1969). 
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In Figure 12, A(n, d) represents all US accidents, a is 8 x 10°, b is between 1.5 
and 3 (depending upon whether #1 = 1 is included), and c is between 4 and 1. Such 
a surface may be defined for any risk, and in many cases the coefficients b and c 


A(n,d): ACCIDENTS PER YEAR INVOLVING 
{n) PEOPLE WHERE AVERAGE DAYS LOST 
PER PERSON IS (d) 


AVERAGE 
#- DAYS LOST 
PER PERSON (qd) 


NUMBER OF PEOPLE INJURED 
PER ACCIDENT (n) 


Figure 12 Distribution of fatal and disabling injuries by magnitude and severity. (@) Single 
injury per accident (1 day disability); © single fatality per accident (6000 day equivalent); 
©) maximum group per accident with | day average disability; @ maximum fatalities 
per accident. 
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appear to be similar. Some rather special cases may be considcred that fit the 
general form of the relation, although the constants will be quite different from 
those for average risks. Two examples mentioned previously are drowning and 
electrocution, which would be expected to have a very high value for c. This is 
due to the nature of these risks in which the damage thresholds are quite close. 
To this end, c is a measure of the individual resiliency to a risk. The constant b 
(related to the number of people involved per accident) will vary with the distribution 
characteristics of the population. In the case of aircraft accidents, the population 
density is quite high at the point of energy release, which would suggest a higher 
value for 6. The usefulness of such a surface is indicated for those risks resulting 
in a distribution similar to that for all accidents: a great deal of information can be 
inferred from a slight bit of statistical information. From a societal point of view, 
the total number of disability days T (and hence the social cost) resulting from a 
particular risk is simply the volume integral of the surface: 


r= [7] [Ato], 12. 
1 a, 


where d, and d2 are the damage thresholds previously defined. 

In the case of US accidents, d,, the lower threshold for damage, would be one 
disability day (accidents resulting in no disability days do not contribute to the 
total social cost). The National Safety Council equivalent of 6000 disability days 
per death can be used for d>. For b> 1, and 0>c> 1, the total number of 
disability days is 

l-e l-e 
_ aa DE 8 
(b— 1)(1—c) 
From this result, and the estimates for a, b, and c given previously, it is quite 
evident that the most significant contributions to total disability came from accidents 
involving only one individual. It should be noted that T is a measure of social 
cost in disability days and is not representative of personal value systems. 


Uncertainty Principle 


One major factor in the acceptance and perception of risk is the degree of 
uncertainty associated with the probability estimates, particularly of future hypo- 
thesized situations, discussed earlier in the section on perception of risk. It is valuable 
to examine the sources and nature of the uncertainty in a quantitative manner to 
put the discussion of perception in perspective. 

Accident probability estimates for complex systems are usually made by estimating 
the failure probabilities of individual components of the total system, then combining 
the probabilities of the various failure modes by use of fault trees or event trees 
into an overall probability estimate. Uncertainty arises from two sources in such an 
estimate. The first source is that due to statistical variations in the failure probabilities 
of the individual components, and it results simply because the assessor is limited 
to a finite number of experiments (or the operating histories of the components 
is finite). Such uncertainty is reducible by incrcased experimentation, although the 
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cost associated with producing more precise estimates is frequently considered 
excessive. This type of uncertainty is referred to as experimental uncertainty. 

The second source of uncertainty seems more significant in its influence in risk 
perception. This uncertainty is due to modes of failure not previously considered. 
These failures have been termed hypothetical (24), for they are events that have not 
been observed. The hypothetical uncertainty is due to the possibility of unanticipated 
occurrences. While the uncertainty resulting from the possibility of unanticipated 
events is not removable, some justification can be provided for the engineering 
judgment that the unanticipated event risk is not expected to be high. 

In both cases, a simple relationship may be developed to reveal the characteristics 
of the uncertainty as they relate the ‘probability estimate to operating experience 
(which in the first case is equivalent to the number of experiments and in the 
second caseis related to the cumulative operating time). If U, represents experimental 
uncertainty, U,, hypothetical uncertainty, P the assessed probability, N, the 
number ofexperiments that have been run (assumed proportional to the investment J), 
and N>, a relative measure of societal experience with a particular system, then 
the relationship is 


1 1/2 1 2 
Ua y (ar) 4 Fal ; 14. 


U,® ——., 15. 


and thus the total, 


ay a2 


= wae 16. 
(PN)? ” PN, 


U 


The full derivation of these results is in the Appendix. This indicates that two 
types of experiments give information to reduce uncertainty. The first type, Ny, 
carries a cost that increases with decreasing probability of an accident. The second 
type of experiment, N2, is a free by-product of normal operating experience. 

The second relation, that for unanticipated uncertainty, perhaps lends some 
credence to the intuitive statement of an experienced engineer who claims to be 
“confident that everything of significance has been considered.” While this is not 
always true (the designer of the Boeing 727 certainly never considered the 
possibility of a hijacker parachuting from the rear door), an upper bound on the 
probability of these new events does exist. 

While it would be foolish for anyone to claim omniscience in any new technical 
field, nevertheless there is a professional basis for believing that the estimates of 
end-event probability are reasonably correct, i.e. within a few orders of magnitude 
either way. This is because the event-tree analyses indicate that while there may be 
many initiating circumstances, there are a limited number of key effects, that is, 
few outposts result from the event sequence with many inputs. As an extreme 
example, the most serious public hazard from a nuclear power plant would be an 
extensive sequence resulting in large amounts of radioactive emissions to the 
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atmosphere. For this to occur, a substantial fraction of the radioactivity contained 
in the nuclear core would have to be released. We do know that the only way 
this can happen physically is by a melting of the core fuel. Thus, the core melting 
becomes a key point that all initiating circumstances would havé to reach before 
significant public hazard could occur. Thus, even if there are some unknown 
failure modes that might eventually lead to a core meltdown, that particular 
phenomenon acts as a common output for many such event sequences. Thus, if 
the nuclear power plant is designed to handle such an end-point event as a core 
meltdown, the existence of a few unknown sequences presumably will not alter 
significantly the public hazard probabilities. 

The validity of this assumption depends on the ratio of unknown to known 
failure modes of “like kind.” For example, if the unknown are roughly equal in 
number and of roughly the same importance as the known, then the actual 
probability of an end effect would be twice that calculated from the known event 
tree. Because of the uncertainties in the probabilities of failure of an 
individual component or subsystem, the final end-effect probability in a 
nuclear system calculated from known event trees is likely to be uncertain to at 
least one order of magnitude. Thus, an estimated end-release probability of 1077 
(one in ten million per year) may actually be 10 times lower or higher. Therefore, 
a missed failure mode is not important unless it is differs radically from any 
considered in the design and also effectively bypasses many of the plant protective 
systems. Clearly, some experience with, and insight into, plant operating experience 
and failures is necessary to provide the designer with a reasonable base for event-tree 
probability analysis. 


Resilience 


The concept of resilience to a particular event’s impact was introduced oriefly 
in earlier sections, in particular in the discussion of the elasticity of individuals 
to the hazards of drowning or electrocution. This concept can be expanded to the 
societal level to consider those events capable of causing a lasting social impact. 

Two principle types of societal resilience should be examined, relative to two 
different types of damage. First is the accident such as an earthquake or flood 
that causes a great deal of immediate damage. The threat associated with this type 
of event is that the loss of substantial portions of a population and resources will 
require a substantial effort and time for recovery. The second type of risk to a 
society is that which threatens the societal structure and culture, rather than large 
losses of life. This second type of risk and its relations to societal resilience is of 
great importance, for large-scale physical disasters have been routinely tolerated by 
societies for years, and populations continue-to live in areas of high risk from 
flooding or earthquakes. 

The importance of the resilience factor is the apparent nonlinearity of societal 
response to accidents as the impacts increase. The following quotation (25) perhaps 
dramatizes the issue: 


Small accidents throughout the world kill about 2 million people each year, or 
4 billion people in 2000 years. This is “acceptable” in the sense that society will 
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continue to exist, since births continually replace the deaths. But ifa single accident were 
to kill 4 billion people, that is, the population of the whole world, society could not 
recover. This would be unacceptable even if it only happened once in 2000 years. 


The concept of resilience deals primarily with the survivors’ point of view, 
unlike individual risk acceptance. 

An example of the risk to societal stability is war, in which the loser suffers 
a dramatic change in structure and culture, as in the South following the US 
Civil War. A more localized threat would be the case of increasing water pollution 
in an area where the predominant industry is fishing, as has happened with 
mercury in some areas of Japan. The key factor in both of these cases is the long 
time required for cultural recovery. In the production of electricity, this is 
probably a key factor in the perception of risk from nuclear power plants. While 
a number of studies have indicated that the risk of nuclear power is lower than 
that of fossil-fueled electric power of hydroelectric power, the time frames associated 
with waste management and the fear of long-term contamination represent a type 
of risk different from a dam collapse or oil tanker explosion. While these risks 
have been exaggerated in many instances, the nature of this type of risk is subject 
to a set of social values diffcrent from the more direct threats. This is perhaps the 
reason for increasing concern over acid rainfall and trace metal contamination 
resulting from the combustion of coal. As a further example, a prolonged energy 
shortage could produce a severe economic impact, resulting in substantial social 
changes. It is for this reason that the factors of societal resilience need to be 
considered in national planning. 

This study of societal resilience is an approach to the evaluation of the elasticity 
of a society to high-impact events and to the identification of those characteristics 
of societies that determine such resilience. One such factor is the level of techno- 
logical development of the society. The more technically advanced a society is, the 
lower its resilience. This is due to a complex societal infrastructure that cannot 
operate with a sizable portion of its subsystems missing. In less developed areas, 
with less division of labor, the culture is more immune to accidents. An example 
of the lesser resilience of technological cultures may be seen from the bombing 
of ball bearing factories in Germany in World War I. While the ball bearing 
industry was small in comparison to the total industrial capability, the infra- 
structure was such that the loss of ball bearings would have been a substantial 
blow to the society at that time. Conversely, the severe flooding that caused 
over a hundred thousand fatalities in Bangladesh was not a major test of societal 
resilience because the social structure is dependent only upon the quantity of food 
produced, not upon vital industries or key population segments. In such a case, the 
population recovers rapidly to a level constrained only by the food supply. A 
striking example of the sensitivity of the US economy occurred with the oil 
embargo of 1973-1974, and the effects were far reaching even though the imported 
oil represented only a small portion of the total economic expenditure of the 
United States. 

The key factors that seem to determine the societal resilience to a given 
accident or event may be arranged in the following dimensional form; if the 
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resilience is denoted as R, it follows that 


PL 


| ee ace 17. 
B(T)S*t® t§ MS t? 


seems reasonable. In this relation, P is the societal population, L its average 
lifetime, B a monotonically increasing function of the level of technology T, S the 
size of population affected by the event, t, the average recovery time for an injured 
population group, tz the time to discover the source of damage, ft, the time to 
correct the situation, and M the average disability per person affected. The 
factors a, b, e, f, and g are constants. Although there are unquestionably other 
significant factors, this relationship may provide a starting point for work on the 
subject of societal resilience. Ecologists have studied a similar problem, that of 
species resilience (26). The topic of resilience as it relates to a societal value system 
for risk is explored in the discussion of that topic. It should be recognized that this 
relationship is quite crude and serves more as an example than as a proposed 
societal model. 

The impact of considerations of resilience upon the societal value system for 
risk has not been explored in any detail, although a suggestion has been made by 
Wilson (27) to estimate the social costs of accidents of n fatalities as proportional 
to n? rather than n. An additional factor for involuntary risk is referred to as the 
“cost of public confidence.” 

Some inference can be drawn from empirical risk data for the social values 
appropriate to high-impact events. If f, represents the frequency of accidents in 
which n lives are lost, it follows that 

. 4a 

Sn a 18. 
as demonstrated in a previous section. Typical values of b lie between 1.5 and 3.0. 
If one were to make the common overt assumption that all lives lost in accidents 
are of equal value, then the social cost due to the risk of an accident with 
magnitude n is 


fis oom 19. 


wok peat? 

where / is the societal value of each lost life. The conclusion that must be drawn 
from the assumption that all fatalities are of equal cost is that the high-frequency, 
low-magnitude accidents are of greatest social cost because the observed values of b 
are greater than unity. 

An analytic interpretation of the empirical data supports the assumption that for 
fatalities resulting from any technical system, the relationship between accident 
frequencies and number killed has been adjusted by investment in safety so that each 
frequency point has social value equal to any other, ie. 


Inn, = const, 20. 


in which 1, represents the societal value of each life lost in an accident of n 
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fatalities. From equation 20 is derived 


= const 21. 


ia 22. 


The conclusion resulting from such an assumption is that each additional life lost 
in an accident is increasingly more costly to society. The cost of an accident of n 
fatalities is then 


Sat = fyrPly. 23. 
For the case b = 2, this corresponds directly to Wilson’s result (27). 


Objectives of Risk Analysis—Identification 


Threemethodsareemployed to identify risk : empirical evidence, statistical inference, 
and postulation based upon a transfer of experience or the laws of nature. Risk 
identification through empirical or statistical means is straightforward, but the third 
method is of more interest in the energy field because the types of risk associated 
with new or developing technologies are frequently postulated. This course is usually 
preferable becduse action may be taken before a statistically significant portion of 
the population is injured. In the energy area, the most widely studied risks are 
those from nuclear power. While no members of the public have been killed or 
injured bycommercial nuclear plants, a number of possible risks have been identified 
and studied, by using a transfer of experience from radiation effects upon animals 
and from people exposed to radiation from sources other than power plants. 


Risk Estimation 


The estimation of risk contains both estimates of exposure probabilities and event 
impacts. These estimates generally require different skills. As an example in the 
energy field, the risk from accidents in light-water reactors is estimated by computing 
theprobability ofthe release ofa specified amount of radioactive material, estimating 
the subsequent exposure of a population to this material, and then estimating the 
health effects due to that level of exposure. 

In this case, the first two estimates (release probability and subsequent exposure) 
are within the realm of the engineer or physical scientist. The estimate of health 
effects due to the postulated exposure is made by medical specialists, usually 
health physicists. For this case, the greatest uncertainties seem to lie within the 
estimates of the probabilities of release; the estimates of exposure due to a release 
and predicted effect of exposure are more generally accepted. The situation is quite 
opposite for the estimates of health effects due to the routine emissions of fossil- 
fueled power plants and automobiles. The exposure levels are directly measurable, 
but the health effects are not well known. The two roles—probability estimation and 
impact estimation—are not completely separable, for the probability varies with 
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the postulated amount of impact. This relationship was previously explored under 
the first hypothesized law of risk, the logarithmic relationship between probability 
and impact. 

Estimates can be developed in four ways. First, the analyst can apply the laws 
of nature directly, even though these laws may be empirically based. An example 
of this would be an estimate of the probability of failure of a component due 
to metal fatigue. Second, the estimates can be developed from: historical or 
experimental data. This is generally the source of estimates for failure or accident 
rates of widely used devices such as pumps and relays, or for activities such as 
automotive travel, skiing, or coal mining. The third method is that of transfer of 
experience, where probabilities of failure are assumed similar to those of similar 
devices. The final method, systems modeling, is actually a combination of the 
previous methods and usually includes the estimation of accident trees. This last 
method provides estimates for complex technologies without established accident 
rates. Estimates of risk from nuclear reactors are made in this manner. 


CONCLUSION 


Risk-benefit analysis is an increasingly important part of technology assessment. 
As the capability to estimate the external effects of technical systems improves, 
and as the ability to modify and reduce risk from these systems develops, a 
methodology to deal with questions such as “How safe is safe enough ?” is needed to 
efficiently allocate societal resources. 

Three principal areas of application of risk-benefit analysis have been identified. 
The most fundamental application concerns the societal choice of expanding or 
curtailing the development of our existing technological capabilities. For example, 
the relative emphasis on mass and individual transportation systems is such an 
issue. A second area for risk-benefit analysis is in setting performance targets for 
existing or new technologies where trade-offs between safety, environmental effects, 
and cost can produce major social and economic impacts—for example, air quality 
criteria. The third application involves decisions between competitive technical 
systems that produce a similar beneficial function but with differing societal costs. 
For example, the selection of either coal or uranium as a fuel system for a new 
electrical power plant must be based on a comparison of their social costs, since 
the same output of electricity would be generated by both. 

A step-by-step procedure to deal adequately with such issues is not yet available. 
Rather than try to describe the various suggested methodologies in detail, we have 
reviewed the general philosophic features common to most risk-benefit decisions. 
In many cases we have deliberately simplified analytical descriptions of the important 
dimensions of risk, with the hope that this might seed future work in these areas. 


APPENDIX: UNCERTAINTY PRINCIPLE 


Ifexperiments and analyses are applied to the assessment of a probability, uncertainty 
will accompany the assessment for two reasons. First, the usual sort of uncertainty 
duc to a finite (rather than infinite) number of experiments will be present, and 
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second, a possibility exists that events will occur through mechanisms not considered 
in the analysis. What is usually of primary interest is an upper bound on the 
estimate of uncertainty, and attempts to estimate the difference between the assessed 
value and this upper bound refer to the bias in a system. The word bias 
unfortunately carries different connotations to the nonstatistician readers from the 
meaning of the word to statisticians. Because it is hoped that the reference to this 
topic will interest both groups, the word uncertainty is used and defined in a 
rather arbitrary manner. In addition, the derivation is not strictly rigorous but 
serves to demonstrate the functional form of the relationship. 

If the assessed failure probability is termed P,, the uncertainty U, and the true 
failure rate that would in theory be observed with unlimited operating experience 
P,, it follows that 


P,(1+U) = P,. A.l 


This definition was chosen because the uncertainty associated with low-probability 
events is frequently expressed as a product, e.g. the probability is P, to within a 
factor of 20. The quantity (1+ U) was chosen so zero uncertainty would refer to 
P,=P,. 

As mentioned above, the uncertainty arises from two sources. The first source, 
experimental uncertainty, is usually expressed as confidence limits for a number of 
standard deviations, o, around the assessed probability. The second source is the 
probability of new events, termed P,. For the upper bound, we find that 


Pim Piatra +P, - A2 
‘where a is a constant. From equation A.1 is derived 
P,1+U)=P,+ao+P, A3 
and ‘ 
ao =6O~P, 
U=—+—=U,+U,. A4 
Pio P i, = 


Uncertainty Principle for Experimental Testing 


The value of U, may be computed from the common method of defining 
confidence limits. In this case P* is the upper bound threshold probability and 
@(y) is the cumulative probability of a normal distribution. 

To compute the one-sided confidence limit, the cumulative distribution is 


ae Nd 

O(y) = sam exp(—4nx?) dx. A.5 
The confidence is defined by 

p*—p 

Sie ey A.6 
o 


where the law of large numbers justifies the choice of a normal cumulative function. 
For a binomial process (experiments that result in either success or failure) the 
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standard deviation for the estimated mean is 


_ 1/2 
o(P) = [| Al 
n 
where n is the number of tests. 
For 
P* = (1+U,)P, A8 
we find that 
U)p— 
Waal Lea Ad 
0 
or 
yo 
U,=—. A.10 
P 


This is the same as the previous definition from equation A.4. 
For this case we find that 


P(1—P) |! 
al) dn ; All 


Ue : 


and for P < 1, this reduces to 
1 


U,= ——: A.12 
(Pn)"!? 


New-Event Uncertainty Principle 


It is assumed that some probability of system failure can be due to the occurrence 
of a “new” event, that is, one for which statistics are not available and estimates 
of failure due to this event were not included in the assessment. 

This situation is roughly similar to a series of experiments (in this case operating 
experience and transfer of experience) during which no failures were observed as a 
result of this particular cause. If this is considered in the framework of Baysian 
analysis, with a diffuse prior probability, then the probability distribution for such 
aneventis ~ 


F (Px) = (N+1)(1— Pd", A.13 


where N represents the operating experience. If one considers events such as “giant 
meteor destroys earth,” N is 4 x 10° years (the age of the earth). The expected value 
of the probability in this case is 
E(P.) A.14 
""N+2° N° 
As a result, the probability that a giant meteor will destroy the earth is expected 
to be 2.5 x 10° '°/year, if only the experimental evidence with the absence of such 
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meteors is considered. This simplistic approach assumes that the probability of 
meteors has not changed over the last 4 x 10° years. 
From the definition of new-event uncertainty (equation A.4) is derived 
P, 1 


Un=— 


2 —. A.15 
P, NP, 


From the brief example it seems clear that risks or system failure probabilities of 
less than 2.5 x 10~'° are not really worth considering, as an unremovable risk 
threshold of 2.5 x 107 !° has been defined. 
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